EDR watches what actually happens on laptops and servers, records it, and lets you detect and shut down an attack that has already got past prevention.
The short answer
EDR stands for endpoint detection and response. An agent on each device records process launches, file changes, registry edits and network connections, then flags behaviour that looks like an attack. Unlike antivirus, which blocks known bad files, EDR assumes something will get through and gives you the recording plus the ability to isolate the device.
The shift is from matching signatures to watching behaviour. A legitimate tool used the wrong way, such as PowerShell reaching out to an unknown host, has no signature to match but a very clear behavioural pattern.
On this page
EDR compared with antivirus
What EDR does
| Capability | Why it matters |
|---|---|
| Continuous recording | Process, file, registry and network activity kept so an incident can be reconstructed after the fact |
| Behavioural detection | Flags patterns rather than files, catching legitimate tools used maliciously |
| Device isolation | Cuts a compromised laptop off the network in one action while keeping your access to investigate |
| Threat hunting | Lets you search every endpoint for an indicator when a new threat is published |
| Rollback and remediation | Kills the process, quarantines the file and, in some cases, reverses the changes made |
The question EDR answers
After an incident, someone will ask what the attacker touched and whether customer data was reached. Without endpoint recording, that answer is a guess, and a guess is not something you can put in a breach notification.
EDR, MDR and XDR
| Term | What it means |
|---|---|
| EDR | The technology on the endpoint. You operate it and respond to its alerts |
| MDR | A service. Someone else monitors your EDR and responds on your behalf |
| XDR | Detection extended beyond the endpoint to identity, cloud, network and email, correlated together |
For a small team the practical question is who reads the alerts. EDR without anyone watching it becomes a recording nobody plays back.
How Osto covers the endpoint
Osto provides endpoint protection, device control and content filtering through a managed agent, with macOS support. The same agent underpins access: through ZTNA, internal resources stay unreachable unless that agent is installed and MFA is satisfied, so a device that falls out of policy loses access rather than just generating an alert. Endpoint events feed the same SIEM as identity, cloud and network activity, which is what turns an isolated device alert into a full picture of an incident.
Free security assessment
Detection that does not need a security team
Endpoint protection and device control with the agent that also gates access, so a device out of policy loses access rather than just alerting.
Get a free security assessment Book a platform walkthroughmacOS agent · Access tied to device state · One platform, everything
Frequently asked questions
What does EDR stand for?
Endpoint detection and response. An agent records activity on laptops and servers, detects behaviour that indicates an attack, and provides the tools to investigate and contain it.
What is the difference between EDR and antivirus?
Antivirus blocks files it recognises as malicious. EDR assumes something will get past that and focuses on detecting attacker behaviour, preserving a timeline and letting you isolate the device. Most organisations run both.
Is EDR the same as MDM?
No. MDM manages device configuration: encryption on, screen lock set, OS current. EDR detects and responds to threats running on the device. They answer different questions and are usually deployed together.
Do small teams need EDR?
They need the outcome: detection of what prevention missed, and enough recording to answer what happened. A full EDR product assumes someone is watching alerts. Teams without that capacity are better served by endpoint protection integrated with the rest of their stack.
Do frameworks require EDR?
None name the technology. ISO 27001:2022 covers malware protection in Annex A 8.7 and monitoring in A 8.16, and SOC 2 expects evidence of detection and incident response. Enterprise questionnaires often ask about endpoint detection specifically.